ZettaGames is built for anonymous play. When you open the site for the first time we create an account automatically: a random identifier, a generated display name such as Player-7KQ2M, and a deterministic avatar derived from that identifier.

We do not ask for an email address, a phone number, a real name or a password. There is no sign-up form, and there is nothing you have to hand over to play.

A single first-party cookie stores a 32-byte cryptographically random session token. It is set with HttpOnly, Secure (in production) and SameSite=Lax. JavaScript in the page cannot read it.

The database stores only the SHA-256 hash of that token — never the token itself. If our database were ever exposed, the hashes could not be replayed as valid sessions.

For each run we store the game played, the start and end time, the duration, and the score.

To keep leaderboards honest without watching you type, the server issues a random seed when a run starts. Your browser records the moves you make, and on submit the server replays that move log through the same engine and recomputes the score. Runs that are impossible, too fast, or inconsistent with the issued seed are flagged or rejected rather than silently accepted.

For a match we store the game, the mode (ranked, casual, custom or bot), the participants, the ordered event log of moves, the result and — for ranked matches only — the rating change each participant received.

Matchmaking stores a short-lived queue entry with your rating at the time you queued. It is removed when the queue resolves, when you cancel, or when it times out.

Chat messages are stored with their author, room and timestamp so they can be shown to other participants and reviewed when a message is reported. Reports and support tickets are stored with the reason text you provide. Please do not paste another person's personal information into them.

Staff can read chat history and tickets. Chat is not end-to-end encrypted and is not private from staff.

Staff accounts are separate from player accounts and store a username, an email address, a scrypt password hash and, if enabled, a TOTP secret and hashed recovery codes. Every privileged staff action is written to an append-only audit log with the acting account, the target record and a timestamp.

• No advertising trackers and no third-party analytics pixels.
• No selling, renting or sharing of personal data.
• No cross-site fingerprinting. We never re-identify an account from IP address, user agent, screen size or any device fingerprint.
• No hidden telemetry in the game clients.

Accounts and their scores persist indefinitely so leaderboards stay meaningful. If you want your data removed, you can request deletion and we will erase the player row together with its sessions, stats, achievements, chat messages and activity — cascading deletes are defined in the schema.

Revoking every recovery code and clearing your cookie makes the account unreachable, but does not by itself delete the rows. Request an explicit deletion if that is what you want.

• Rename yourself and change your avatar at any time from your profile.
• Issue, use and revoke recovery codes from the recovery page.
• Block another player so their chat messages are hidden from you.
• Forget the current browser from settings — this drops the cookie but keeps the account.
• Turn off sound and reduce motion in settings.

The platform is a general-audience game site intended for players aged 13 and over. Because we collect no contact details, we never knowingly profile minors.

If this policy changes materially we will update this page. Continued play after a change means you accept the updated terms. Questions can be raised through support.